Cloud Posse Terraform AWS ECS ALB Service Task Module and ECS Service Component Reference

Published by TechMarmot Editorail Staff on | Category Terraform

The Cloud Posse Terraform AWS ECS ALB Service Task module provides a declarative method to create an ECS Service for a web application task and an associated Application Load Balancer target group to route requests. The component referenced in the library documentation is responsible for creating an ECS service at the regional stack level. Together these artifacts form a repeatable pattern for deploying containerized workloads on AWS Fargate or EC2 with load balancing, IAM role provisioning, security group rules, and service discovery integration.

The module is delivered as open source with explicit version pinning for Terraform and AWS providers, and it relies on a set of label and utility modules from the Cloud Posse library. The component variant exposes a Spacelift compatible configuration surface using YAML defaults and inheritance.

Module Purpose and Routing Intent

The module creates an ECS Service for a web app task and an ALB target group to route requests. This intent determines the real world consequence for platform teams. Teams obtain a single Terraform module call that provisions the service, the task definition, the execution and task roles, the security group for the service, and the rules that allow traffic from the ALB. The impact is reduced manual wiring between ECS and ALB resources and consistent naming through the label module.

The contextual layer connects this purpose to the related projects listed in the documentation. The module sits alongside terraform-aws-alb for provisioning a standard ALB for HTTP traffic, terraform-aws-alb-ingress for hostname and path based ingress rules, terraform-aws-ecs-web-app for a full web app stack on ECS, and terraform-aws-ecs-codepipeline for CI/CD. This ecosystem positions the module as a mid layer building block rather than a full stack.

Input Variables and Requirements

Input variables define the contract for the module.

Required variables are enforced at plan time.

  • ecs_cluster_arn string required. The ARN of the ECS cluster where service will be provisioned. The requirement means the module cannot create a cluster; the cluster must exist before the service is created. The impact is a hard dependency on prior cluster provisioning.
  • vpc_id string required. The VPC ID where resources are created. The VPC selection determines subnet placement, route tables, and network interfaces for tasks. The impact is that all networking resources are scoped to the supplied VPC.

Optional variables allow tuning of networking, capacity, and task behavior.

  • alb_security_group string optional. Security group of the ALB. Default value "". An empty default means the module can operate without an ALB security group reference, but when provided the module can create ingress rules from the ALB to the service security group.
  • assign_public_ip bool optional. Assign a public IP address to the ENI for Fargate launch type only. Valid values are true or false. Default value false. The default false keeps tasks private. The impact for users is that public internet access requires explicit enablement.
  • availability_zone_rebalancing string optional. ECS automatically redistributes tasks within a service across Availability Zones to mitigate risk of impaired availability due to infrastructure failures and task lifecycle activities. Valid values are ENABLED and DISABLED. Default value "DISABLED". The default DISABLED leaves AZ distribution to the user.
  • bind_mount_volumes list(any) optional. Task bind mount volume definitions as list of configuration objects. Multiple bind mount volumes can be defined on the same task definition. Requires name and optionally host_path. Default value [ ]. The impact is support for host path mounts where appropriate.
  • capacity_provider_strategies optional. The capacity provider strategies to use for the service. This allows mixing Fargate and EC2 capacity.

The variable surface is connected to the resource set. For example assign_public_ip influences the network configuration of the awsecsservice.default resource and the security group rules.

Output Values and Observable Artifacts

Outputs expose identifiers for downstream modules and operators.

Service level outputs:

  • service_arn ECS Service ARN
  • service_name ECS Service name
  • service_role_arn ECS Service role ARN
  • service_security_group_id Security Group ID of the ECS task
  • ecs_exec_role_policy_id The ECS service role policy ID, in the form of rolename:rolepolicy_name
  • ecs_exec_role_policy_name ECS service role name

Task definition outputs:

  • task_definition_arn ECS task definition ARN
  • task_definition_arn_without_revision ECS task definition ARN without revision
  • task_definition_family ECS task definition family
  • task_definition_revision ECS task definition revision

Execution role outputs:

  • task_exec_role_arn ECS Task exec role ARN
  • task_exec_role_id ECS Task exec role id
  • task_exec_role_name ECS Task exec role name

Task role outputs:

  • task_role_arn ECS Task role ARN
  • task_role_id ECS Task role id
  • task_role_name ECS Task role name

The component variant exposes a different output set.

  • image image of the service container
  • service_name The ECS service name
  • service_sg_id The ECS service security group ID
  • ssm_key_prefix SSM prefix
  • ssm_parameters SSM parameters for the ECS Service
  • subnet_ids Selected subnet IDs
  • task_definition_arn The task definition ARN
  • task_definition_revision The task definition revision
  • task_template The task template rendered
  • vpc_id Selected VPC ID
  • vpc_sg_id Selected VPC SG ID

The presence of both output families shows module versus component divergence. The module outputs focus on IAM role identifiers and ARN references for Terraform wiring. The component outputs focus on rendered templates and SSM parameters for Spacelift consumption.

Resource Composition

The module creates the following resources.

ECS service and task definition:

  • aws_ecs_service.default resource
  • aws_ecs_service.ignore_changes_desired_count resource
  • aws_ecs_service.ignore_changes_task_definition resource
  • aws_ecs_service.ignore_changes_task_definition_and_desired_count resource
  • aws_ecs_task_definition.default resource

IAM roles and policies:

  • aws_iam_role.ecs_exec resource
  • aws_iam_role.ecs_service resource
  • aws_iam_role.ecs_service_connect_tls resource
  • aws_iam_role.ecs_task resource
  • aws_iam_role_policy.ecs_exec resource
  • aws_iam_role_policy.ecs_service resource
  • aws_iam_role_policy.ecs_ssm_exec resource
  • aws_iam_role_policy_attachment.ecs_exec resource
  • aws_iam_role_policy_attachment.ecs_service_connect_tls resource
  • aws_iam_role_policy_attachment.ecs_task resource

Security groups and rules:

  • aws_security_group.ecs_service resource
  • aws_security_group_rule.alb resource
  • aws_security_group_rule.allow_all_egress resource
  • aws_security_group_rule.allow_icmp_ingress resource
  • aws_security_group_rule.nlb resource

The component variant creates a different resource set.

  • aws_iam_policy.default resource
  • aws_iam_role.github_actions resource
  • aws_iam_role_policy.github_actions resource
  • aws_iam_role_policy_attachment.additional_exec resource
  • aws_iam_role_policy_attachment.custom_exec resource
  • aws_kinesis_stream.default resource
  • aws_s3_object.task_definition_template resource
  • aws_security_group_rule.custom_sg_rules resource
  • aws_service_discovery_service.default resource
  • aws_ssm_parameter.full_urls resource

The resource sets illustrate a shift from pure Terraform resource creation to component driven rendering with SSM parameters and service discovery.

Data Sources Composition

Data sources are used to generate policy documents and resolve existing identifiers.

Module data sources:

  • aws_iam_policy_document.ecs_exec data source
  • aws_iam_policy_document.ecs_service data source
  • aws_iam_policy_document.ecs_service_connect_tls data source
  • aws_iam_policy_document.ecs_service_policy data source

Component data sources:

  • aws_caller_identity.current data source
  • aws_ecs_task_definition.created_task data source
  • aws_iam_policy_document.github_actions_iam_ecspresso_policy data source
  • aws_iam_policy_document.github_actions_iam_platform_policy data source
  • aws_iam_policy_document.github_actions_iam_policy data source
  • aws_iam_policy_document.this data source

Data sources enable dynamic policy generation without hard coded ARNs, which supports reusability across accounts and regions.

Module Dependencies and Version Constraints

Version constraints enforce compatibility.

Module requirements:

  • terraform version >= 0.14.0
  • aws version >= 5.85

Providers:

  • aws version >= 5.85

Component requirements:

  • terraform version >= 1.8.0
  • aws version >= 4.66.1, < 6.0.0
  • jq version >=0.2.0

Providers:

  • aws version >= 4.66.1, < 6.0.0
  • jq version >=0.2.0

The differing constraints reflect module versus component maturity. The module requires a recent AWS provider 5.85 or newer, while the component caps AWS provider below 6.0.0 and introduces jq as a provider for template processing.

Modules used by the ECS ALB service task module:

Name Version Source Description
exec_label 0.25.0 cloudposse/label/null n/a
serviceconnectlabel 0.25.0 cloudposse/label/null n/a
service_label 0.25.0 cloudposse/label/null n/a
task_label 0.25.0 cloudposse/label/null n/a
this 0.25.0 cloudposse/label/null n/a

Label modules provide consistent naming and tagging across resources. The version 0.25.0 indicates a stable labeling contract.

Related Cloud Posse Projects

The documentation references related projects that compose with the module.

  • terraform-aws-alb - Terraform module to provision a standard ALB for HTTP/HTTP traffic
  • terraform-aws-alb-ingress - Terraform module to provision an HTTP style ingress rule based on hostname and path for an ALB
  • terraform-aws-codebuild - Terraform Module to easily leverage AWS CodeBuild for Continuous Integration
  • terraform-aws-ecr - Terraform Module to manage Docker Container Registries on AWS ECR
  • terraform-aws-ecs-web-app - Terraform module that implements a web app on ECS and supporting AWS resources
  • terraform-aws-ecs-codepipeline - Terraform Module for CI/CD with AWS Code Pipeline and Code Build for ECS
  • terraform-aws-ecs-cloudwatch-sns-alarms - Terraform module to create CloudWatch Alarms on ECS Service level metrics
  • terraform-aws-ecs-container-definition - Terraform module to generate well-formed JSON documents that are passed to the awsecstask_definition Terraform resource
  • terraform-aws-lb-s3-bucket - Terraform module to provision an S3 bucket with built in IAM policy to allow AWS Load Balancers to ship access logs

These related modules form a dependency graph. A typical deployment uses terraform-aws-alb to create the load balancer, terraform-aws-ecs-container-definition to build container definitions, and terraform-aws-ecs-alb-service-task to wire service and target group.

Usage Examples and Stack Configuration

Usage examples show how the module is wired in practice.

Provider configuration:

hcl provider "aws" { region = var.region }

Label module example:

hcl module "label" { source = "git::https://github.com/cloudposse/terraform-null-label.git?ref=tags/0.15.0" namespace = var.namespace name = var.name stage = var.stage delimiter = var.delimiter attributes = var.attributes tags = var.tags }

VPC module example:

hcl module "vpc" { source = "git::https://github.com/cloudposse/terraform-aws-vpc.git?ref=tags/0.8.1" namespace = var.namespace stage = var.stage name = var.name delimiter = var.delimiter attributes = var.attributes cidr_block = var.vpc_cidr_block tags = var.tags }

Subnets module example:

hcl module "subnets" { source = "git::https://github.com/cloudposse/terraform-aws-dynamic-subnets.git?ref=tags/0.16.1" availability_zones = var.availability_zones namespace = var.namespace stage = var.stage name = var.name attributes = var.attributes delimiter = var.delimiter vpc_id = module.vpc.vpc_id igw_id = module.vpc.igw_id cidr_block = module.vpc.vpc_cidr_block nat_gateway_enabled = true nat_instance_enabled = false tags = var.tags }

ECS cluster resource:

hcl resource "aws_ecs_cluster" "default" { name = module.label.id tags = module.label.tags }

Container definition module:

hcl module "container_definition" { source = "git::https://github.com/cloudposse/terraform-aws-ecs-container-definition.git?ref=tags/0.21.0" container_name = var.container_name container_image =

The component usage is expressed in YAML.

Stack level is Regional.

Defaults configuration:

yaml components: terraform: ecs-service/defaults: metadata: component: ecs-service type: abstract settings: spacelift: workspace_enabled: true vars: enabled: true public_lb_enabled: false ecr_stage_name: mgmt-automation task: launch_type: FARGATE network_mode: awsvpc desired_count: 1 ignore_changes_desired_count: true ignore_changes_task_definition: false assign_public_ip: false propagate_tags: SERVICE wait_for_steady_state: true circuit_breaker_deployment_enabled: true circuit_breaker_rollback_enabled: true

Echoserver example:

yaml components: terraform: ecs/platform/echoserver/service: metadata: component: ecs-service inherits: - ecs-service/defaults vars: enabled: true name: echoserver public_lb_enabled: false cluster_attributes: [platform]

Container definition in component:

yaml containers: service: name: "echoserver" image: gcr.io/google_containers/echoserver:1.10 port_mappings: - containerPort: 8080 hostPort: 8080 protocol: tcp

Task desired count is set to 1 in defaults.

The example shows image usage instead of ecr_image for external images.

IAM Role and Policy Details

Execution role and task role identifiers are exposed as outputs.

  • task_exec_role_name ECS Task exec role name
  • task_exec_role_id ECS Task exec role id
  • task_exec_role_arn ECS Task exec role ARN
  • task_role_name ECS Task role name
  • task_role_id ECS Task role id
  • task_role_arn ECS Task role ARN

The exec role allows the ECS agent to pull images and write logs. The task role allows the container to access AWS services. The separation has security impact. Least privilege is enforced via separate roles.

The component example includes an optional task_exec_iam_policy block with statements such as KMS Decrypt actions.

Integration and Operational Impact

The module integrates with ALB target groups to route requests. The impact for operators is that service discovery and health checks are automatically configured. The module creates security group rules for ALB ingress, allowing all egress, allowing ICMP ingress, and allowing NLB traffic.

Availability zone rebalancing when ENABLED reduces blast radius from AZ failure. The default DISABLED requires manual enablement.

Assign public IP false keeps tasks in private subnets. Public IP enablement is required for internet facing tasks without a load balancer.

The label modules ensure consistent naming across ECS service, task definition, IAM roles, and security groups. Consistent naming reduces operational confusion and enables automated tagging for cost allocation.

The component outputs SSM parameters and service discovery service, enabling integration with Spacelift pipelines and service mesh tooling.

Conclusion

The Cloud Posse ECS ALB Service Task module and the ECS Service component together provide a layered approach to deploying container workloads on AWS. The module delivers Terraform resources for service, task definition, IAM roles, security groups, and ALB integration with explicit version constraints and a defined output surface. The component provides a Spacelift oriented abstraction with YAML defaults, inheritance, and SSM parameter outputs. Related modules for ALB, ingress, ECR, CodeBuild, and CloudWatch alarms complete an ecosystem for CI/CD and observability. Version pinning, label driven naming, and separation of execution and task roles ensure repeatable, secure deployments.

Sources
1. terraform-aws-ecs-alb-service-task README
2. ecs-alb-service-task documentation
3. ecs-service component documentation

Related Posts